This is a superseded version and may differ from the one now in force.
Effective Date: September 1, 2026
Patty Co., Ltd. (the “Company”) values the personal information of users in providing Patty Code, an AI-powered development support service (“Patty Code” or the “Service”), and complies with the Personal Information Protection Act and other applicable laws and regulations.
Through this Privacy Policy, the Company explains the purposes and categories of personal information processed, retention periods, provision and outsourcing of personal information, cross-border transfers, rights of data subjects, and measures taken to protect personal information.
> This English text is a reference translation of the Korean original. If the two versions differ in meaning, the Korean version governs.
The purpose of this Privacy Policy is to set forth matters concerning personal information processed by the Company in the course of providing Patty Code, the rights of data subjects, and the Company’s personal information protection measures.
This Privacy Policy applies to the processing of personal information carried out in connection with the Patty Code public cloud service directly operated by the Company and common services directly managed by the Company, including account management, authentication, payments, and customer support.
Where a Customer directly operates an enterprise, public-sector, or sovereign deployment environment on its own servers or infrastructure and determines the purposes and means of processing personal information, the Customer’s privacy policy and any individual agreement between the Customer and the Company may take precedence with respect to such processing.
Even in the circumstances described in the preceding paragraph, this Privacy Policy applies to the extent that the Company directly processes personal information for account management, licensing, payments, customer support, or other business purposes.
Where an enterprise or institutional Customer acts as the personal information controller and the Company processes personal information on the Customer’s instructions, a data processing agreement (“DPA”) or other individual agreement entered into between the Customer and the Company may also apply.
The Company processes personal information to the extent necessary for the following purposes.
The Company may use personal information, pseudonymized information, and information generated or processed during use of the Service for the following purposes, to the extent permitted by applicable laws and regulations, where any of the following applies:
The purposes of such processing include:
Consent under Item 1 above is optional, and refusing such consent will not affect the User’s ability to use the basic features of Patty Code.
The Company provides marketing and advertising information only where the User has separately consented.
The Company does not use personal information for purposes other than those described above. If the processing purposes change, the Company will take the measures required under applicable laws and regulations.
The Company may process the following personal information in connection with provision of the Service.
| Purpose of Processing | Categories of Information |
|---|---|
| Membership registration, login, account creation and management | Email address, one-way password hash, display name, account identifier |
| Login and session management | Device access information, access time, session and authentication-related information |
| Management of policy consent records | Versions of the Terms of Service, Privacy Policy, Refund and Subscription Policy, and other policies; date and time of consent; marketing consent status and date and time of consent or withdrawal; AI model development and training consent status and date and time of consent or withdrawal |
The Company does not store User passwords in plaintext and processes them in a manner that cannot be decrypted.
Where a User uses social login, the Company may receive information necessary for membership registration and login from the following providers.
| Provider | Information Received |
|---|---|
| Email address, name, profile image, account identification information | |
| Apple | Email address or private relay email address provided by Apple, name, account identification information |
| Kakao | Email address, nickname, profile image, account identification information |
| GitHub | Email address, nickname or display name, profile image, account identification information |
The Company does not continuously store access tokens issued by social login providers and processes them only to the extent necessary for login and account linking.
The Company may conduct an identity verification process during membership registration for identity verification, identification of the same individual, prevention of duplicate registrations, and prevention of fraudulent use.
The Company may receive the following information from an identity verification provider:
The Company does not request or receive information regarding whether the User is a Korean or foreign national.
The Company stores the following information in its membership database:
Mobile phone numbers, CI, and DI are stored in encrypted form.
Date of birth and gender are received and used during the identity verification process but are not stored in the membership database after verification is completed.
The Company does not use CI or DI beyond identity verification, identification of the same individual, prevention of duplicate registration, and prevention of fraudulent use.
The following information may be processed for device registration, authentication, and Service communications involving the Patty Code harness.
Device-related information
Program-related information
A device identifier issued by the Company is a Service-specific identifier separate from any hardware unique identifier assigned by a device manufacturer.
The following information may be processed during use of the Service:
Patty Code does not upload the entirety of the source code present in a User’s development environment to Company servers in bulk.
File reading, editing, and command execution are generally performed within the User’s development environment. Where necessary to perform AI features, only certain information related to the Task requested by the User may be transmitted to Company systems.
Code, files, or prompts transmitted by the User to the Service may contain personal information of third parties. The User must have lawful authority to process such personal information through the Service.
Where the User directly connects a Third-Party Service, external development tool, or external system, or requests a Task involving such a service, information necessary to perform the Task may be transmitted to the relevant Third-Party Service in accordance with the User’s request and settings. In such cases, the privacy policy and terms of use of the applicable Third-Party Service may apply to that service’s processing of personal information.
The Company may process the following information for AI model development, training, evaluation, and performance improvement to the extent permitted by applicable laws and regulations:
The Company uses the above information for AI model development and training only where any of the following applies:
Consent under Item 1 above is optional, and refusing such consent will not affect the User’s ability to use the basic features of Patty Code.
Where the Company processes information pursuant to Item 2 above, it pseudonymizes the information so that a specific individual cannot be identified, uses only the minimum information necessary for the processing purpose, and applies safeguards required by applicable laws and regulations, including measures to prevent re-identification, separate storage of additional information, access restrictions, and other necessary security measures.
In processing pseudonymized information, the Company minimizes personal information unnecessary for AI model training and takes necessary measures, including screening and exclusion of training data, to prevent third-party personal information lacking a lawful basis for processing from being used for training.
The Company does not use pseudonymized information for the purpose of identifying a data subject or provide such information to a third party for such purpose.
The following information may be automatically generated or processed during use of the Service:
When Paid Services are used, the Company may process the following information:
Detailed payment method information, such as card numbers, expiration dates, and card passwords, is collected and processed directly by the payment service provider and is not directly collected or stored by the Company.
Billing keys for recurring payments are stored using secure encryption.
The following information may be processed in connection with customer support:
Where the User has consented to receive marketing information, the Company processes the following information:
Consent to receive marketing information is optional, and refusing such consent does not affect the User’s ability to use the basic features of Patty Code.
The Company collects personal information through the following methods:
The Company may process information necessary to perform the Task requested by the User, including User questions, relevant portions of code or files, and execution results, in order to provide Patty Code’s AI features.
The entirety of source code and files present in the User’s development environment is not uploaded in bulk to Company servers.
Company personnel do not arbitrarily review User AI conversations during ordinary Service operations. However, authorized personnel may review relevant conversations, development Task records, User Content, and technical information only to the minimum extent necessary for the relevant purpose in any of the following circumstances:
Where enterprise or Organization management features are enabled, Administrators or security personnel designated by the relevant Organization may review or manage Service usage records, audit records, security detection records, and related information within the Organization through Organization-specific management functionality, in accordance with applicable laws and regulations and the Organization’s internal policies.
The Company grants the review permissions described above only to the minimum number of personnel with a business need to access such information, generates and manages relevant access records, and does not use reviewed information for purposes other than those for which access was granted.
AI and development Task-related information, including prompts, AI responses, development sessions, code changes and patch records, command and tool call records, and approval and execution records, is retained until the User directly deletes the relevant record, withdraws from membership, or the service agreement is terminated.
Upon deletion or termination of the service agreement, the Company makes the information immediately unavailable through the Service and, in principle, permanently deletes it from Company systems within 30 days. Information remaining in backup or disaster recovery systems is deleted according to the Company’s established backup deletion cycles.
However, the Company may retain information to the extent and for the period necessary in any of the following circumstances:
Where information is retained for the reasons set forth in Items 1 through 3 above, the Company does not use the information for any purpose other than the applicable retention purpose and deletes it without undue delay once the reason for retention ceases to exist.
The Company may use User information for development, training, evaluation, and performance improvement of the Company’s AI models where any of the following applies:
Consent under Paragraph 1, Item 1 is optional, and the User may refuse such consent without affecting the User’s ability to use the basic features of Patty Code.
Where the Company processes information based on the User’s consent under Paragraph 1, Item 1, the Company may use the User’s prompts, AI responses, portions of source code or files, feedback, and other related information within the scope disclosed during the separate consent process for AI model development, training, evaluation, and performance improvement.
Where the Company processes information under Paragraph 1, Item 2, the Company pseudonymizes the information so that a specific individual cannot be identified and uses only the minimum information necessary for the purpose of scientific research. Such processing is performed separately from processing based on consent and is subject to applicable laws and regulations and the Company’s procedures for processing pseudonymized information.
As a general rule, processing for scientific research under Paragraph 1, Item 2 is limited to information that can be appropriately pseudonymized and is necessary for the research purpose, including User questions and prompts, AI responses and generated results, feedback, and Service usage information. Source code, files, command or tool execution results, and other information that may be highly likely to contain trade secrets, confidential information, authentication information, or third-party personal information are not automatically included in AI model training datasets for scientific research without the User’s separate consent.
However, where the Company needs to process information described in the preceding paragraph for scientific research, it may do so only to the minimum extent necessary for the research purpose after confirming a lawful basis for processing under applicable laws and regulations and implementing appropriate safeguards based on the nature and risks of the information, including risk assessment, detection and removal of personal or confidential information, and data screening and exclusion.
During selection and preprocessing of data for AI model development and training, the Company minimizes personal information unnecessary for the training purpose and implements reasonable detection, filtering, and exclusion measures to prevent direct identifiers, passwords, API keys, access tokens, authentication information, trade secrets, and other protected information from being included in training data.
When processing pseudonymized information, the Company stores additional information separately, limits access permissions to the minimum number of personnel with a business need to know, generates and manages access records, and implements other necessary security measures. The Company does not attempt to re-identify any specific individual from pseudonymized information.
The Company processes information used for AI model training within a training environment directly managed by the Company and does not provide such information for the purpose of training a third party’s AI model without the User’s separate consent or another lawful basis under applicable laws and regulations.
A User may withdraw consent under Paragraph 1, Item 1 to the collection and use of personal information for AI model development and training at any time. Following withdrawal, the Company will not use the User’s information for new AI model development or training based on such consent.
Withdrawal of consent does not, in principle, affect the validity of training lawfully performed before withdrawal under Paragraph 1, Item 1. However, where applicable laws and regulations impose a separate obligation to delete information or suspend processing, the Company will take the measures required under such laws and regulations.
Pseudonymized information lawfully processed for scientific research under Paragraph 1, Item 2 is processed under a legal basis separate from the User’s consent and may therefore continue to be processed to the extent permitted by applicable laws and regulations, regardless of whether the User withdraws consent to the collection and use of personal information.
Specific categories of personal information used for AI model development and training, processing purposes, retention and use periods, matters concerning the processing of pseudonymized information, and consequences of refusing consent are disclosed in this Privacy Policy and during the separate consent process for collection and use of personal information.
The Company retains personal information for the period necessary to achieve the purpose of processing and destroys it without undue delay when the applicable retention period expires or the personal information is no longer necessary.
However, where retention is required by applicable laws and regulations or is necessary for dispute response, protection of rights, legal claims, investigation of security incidents, or similar purposes, the Company may separately retain such information to the extent and for the period necessary for the applicable purpose.
| Personal Information or Record | Retention Period |
|---|---|
| Account information, including email address, password hash, and display name | Until membership withdrawal or termination of the service agreement |
| Name, mobile phone number, CI, and DI | Until membership withdrawal or termination of the service agreement. In principle, deleted within 30 days following ordinary withdrawal |
| Prompts, AI responses, development sessions, code changes and patch records, command and tool call records, approval and execution records | Until directly deleted by the User, membership withdrawal, or termination of the service agreement. Thereafter, in principle, permanently deleted within 30 days |
| Prompts, AI responses, portions of source code or files, feedback, and related information separately consented to for AI model development and training | Until the purpose of AI model development and training is achieved or the User withdraws consent. Where there is no longer a need for retention, deleted in accordance with applicable laws and regulations and the Company’s deletion procedures |
| Records of consent to and withdrawal from AI model development and training | Until consent is withdrawn or membership is terminated, unless a separate retention period is required by applicable laws and regulations |
| Usage records | 2 years, after which they are processed so that individuals can no longer be identified |
| Records of marketing consent and withdrawal | Until consent is withdrawn or membership is terminated, unless a separate retention period is required by applicable laws and regulations |
| Customer inquiry and dispute-handling records | Until the processing purpose is achieved or for the retention period required by applicable laws and regulations |
| Payment and transaction records | For the period prescribed by applicable laws and regulations |
| Information pseudonymized for AI model development and training for scientific research purposes | For the period necessary to achieve the applicable scientific research purpose. Upon achievement of the purpose, deleted without undue delay or anonymized so that it no longer constitutes personal information |
Details regarding deletion of ordinary AI and development Task-related records are governed by Article 2 of Chapter 3, and details regarding processing of information for AI model development and training are governed by Article 3 of Chapter 3.
Where an ordinary User withdraws from membership or terminates the service agreement, the Company deletes identity verification information, including name, mobile phone number, CI, and DI, in principle within 30 days.
However, where fraudulent or abusive use of the Service by a User has been confirmed, the Company may separately retain the following minimum personal information for five years from the date of withdrawal or restriction of use in order to prevent repeated fraudulent use through re-registration, respond to violations of the Terms of Service, and protect the Service:
Personal information retained under the preceding paragraph is not used for purposes other than prevention of fraudulent or abusive use and response to related disputes.
Upon expiration of the retention period, the Company deletes such personal information without undue delay.
Where required by applicable laws and regulations in connection with the provision of Paid Services, the Company retains the following records for the applicable periods.
| Record | Retention Period |
|---|---|
| Records relating to labeling and advertising | 6 months |
| Records relating to contracts or withdrawal from purchases | 5 years |
| Records relating to payments and the supply of goods or services | 5 years |
| Records relating to consumer complaints or dispute resolution | 3 years |
When the retention period for personal information expires or personal information otherwise becomes unnecessary because the processing purpose has been achieved, the Company destroys the personal information without undue delay.
Personal information that must continue to be retained due to applicable laws and regulations, dispute response, security response, or other reasons is separated from ordinary Service data or protected using equivalent safeguards.
Once the applicable reason for retention ceases to exist, the Company destroys the personal information without undue delay.
Electronic files are deleted using secure methods designed to make recovery or restoration difficult.
Where paper documents exist, they are destroyed using methods such as shredding or incineration that make recovery difficult.
Personal information remaining in backup or disaster recovery systems is protected so that it is not used for purposes other than recovery, taking into account the operational cycle and technical characteristics of the relevant system, and is deleted according to established deletion cycles.
The Company does not provide personal information to third parties without the consent of the data subject or another lawful basis under applicable laws and regulations.
In particular, the Company does not provide information used for AI model development or training to a third party for the purpose of training that third party’s AI model without the User’s separate consent or another lawful basis under applicable laws and regulations.
The Company does not currently provide personal information to third parties on a regular basis.
However, the Company may provide personal information to the extent permitted by applicable laws and regulations in any of the following circumstances:
Where information is transmitted to a Third-Party Service directly connected by the User in accordance with the User’s request, processing of such information may be subject to Article 2, Paragraph 5 of Chapter 2 and the terms of use of the applicable Third-Party Service.
Outsourcing of personal information processing is separately governed by Chapter 7.
The Company outsources certain personal information processing activities to the following service providers for provision of the Service.
| Service Provider | Outsourced Processing | Main Information Processed | Processing Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Operation of authentication and Service infrastructure; data storage | Account and authentication information; Service data | Seoul, Republic of Korea |
| Supabase, Inc. | Operation of Service databases | Account-linked information, audit records, support history, etc. | Seoul, Republic of Korea |
| KG Inicis | Mobile phone identity verification | Name, mobile phone number, CI, DI, and information necessary for identity verification | Republic of Korea |
| NICE Payments Co., Ltd. | Payment processing and recurring payments | Information necessary for payment and transaction processing | Republic of Korea |
| Plus Five Five, Inc. (Resend) | Membership authentication; Service notices; marketing email delivery | Email address, recipient name | United States |
| Mixpanel, Inc. | Product usability analysis and Service improvement | User identifier, event logs, usage patterns, device and Service usage information | United States |
| Datadog, Inc. | System monitoring; incident and error analysis | Logs that may contain User identifiers, IP address, error and performance information | Japan |
| Sentry | [Outsourced processing to be confirmed] | [Information processed to be confirmed] | [Processing location to be confirmed] |
During payment processing through NICE Payments, detailed payment method information such as card numbers, expiration dates, and card passwords is collected and processed directly by NICE Payments and is not directly collected or stored by the Company.
The Company may process the following information for payment and subscription management:
Billing keys are stored using secure encryption.
Where a service provider further outsources part of the personal information processing activities, the Company manages and supervises such sub-processing in accordance with applicable laws and regulations and relevant agreements.
The Company may disclose information regarding sub-processors and sub-processing activities on the Company’s website or on a separate sub-processor information page so that data subjects can readily review such information.
Where a service provider changes its sub-processors or sub-processing arrangements, the Company implements necessary management, supervision, and disclosure measures in accordance with applicable laws and regulations.
Where the Company entrusts personal information for processing or storage outside the Republic of Korea in connection with provision of the Service, the Company transfers such personal information abroad in accordance with the lawful grounds and procedures prescribed by the Personal Information Protection Act and other applicable laws and regulations.
Where a cross-border transfer of personal information occurs, the Company discloses information that enables Users to review the categories of personal information transferred, destination country, timing and method of transfer, recipient, purpose of transfer, and retention period.
| Recipient | Country | Purpose of Transfer | Personal Information Transferred | Timing and Method | Retention and Use Period |
|---|---|---|---|---|---|
| Plus Five Five, Inc. (Resend) | United States | Membership authentication; account and Service notices; marketing emails to consenting Users | Email address, recipient name | Transmitted through encrypted communications when an email is sent | Deleted within 90 days after termination of the contract |
| Mixpanel, Inc. | United States | Product usability analysis and Service improvement | User identifier, event logs, usage patterns, device information, Service usage event information | Transmitted through encrypted communications upon Service use or occurrence of an event | For the period necessary under the Company’s Service settings and processing purposes |
| Datadog, Inc. | Japan | System monitoring; error and incident response | User identifiers that may be contained in logs, IP address, error logs, performance information | Transmitted through encrypted communications upon occurrence of system events | For the period necessary under the Company’s Service settings and processing purposes |
| Sentry | [Country to be confirmed] | [Purpose of transfer to be confirmed] | [Personal information transferred to be confirmed] | [Timing and method to be confirmed] | [Retention and use period to be confirmed] |
Amazon Web Services Seoul Region, Supabase Seoul Region, KG Inicis, NICE Payments, and the AI model training and inference infrastructure directly operated by the Company in Korea process personal information domestically and are therefore not included in the cross-border transfer table above.
The Company does not transfer information separately consented to by Users for AI model development and training outside Korea for the purpose of training a third party’s AI model. If such a cross-border transfer occurs in the future, the Company will separately comply with applicable legal procedures, including any required notice or consent.
A data subject may contact the Company regarding cross-border transfers of personal information or, to the extent recognized under applicable laws and regulations, express an objection to such transfer.
If a data subject refuses a cross-border transfer that is necessary for provision of the Service, such as membership authentication or account notices, access to the relevant functionality or Service may be restricted.
Where the Company relies on separate consent from the data subject as the legal basis for a cross-border transfer, the Company will provide advance notice of the categories of personal information to be transferred, destination country, timing and method of transfer, recipient, purpose and retention period, and method for refusal, and will obtain any required consent.
Where the User has consented to receive marketing information, the Company may use Resend to deliver marketing emails regarding new features, product news, events, promotions, and benefits.
Consent to receive marketing information is optional, and the User may withdraw such consent at any time.
Regardless of whether the User has consented to receive marketing information, the Company may provide notices necessary for provision of the Service and performance of the service agreement, including:
Where the User has separately consented, the Company may provide information including:
The User may withdraw consent to receive marketing information at any time, and withdrawal does not affect use of the basic Service.
The following information may be automatically generated or processed during use of the Service:
The Company processes such information for Service provision, User authentication, security, incident response, usage statistics analysis, and Service improvement.
Where information described in Paragraph 1 is used for AI model development or training, the legal bases and safeguards set forth in Article 3 of Chapter 3 apply.
The Company may use cookies or similar technologies for purposes such as maintaining login sessions, authentication, security, and Service usage analytics.
The Company does not currently use cookies for personalized advertising or cross-site tracking for advertising purposes.
Users may restrict or refuse the storage of cookies through their browser settings. However, restricting cookies that are necessary for operation of the Service may limit access to certain functions, including login.
To the extent provided by applicable laws and regulations, data subjects may exercise the following rights:
Data subjects may exercise their rights relating to personal information through:
Consent to the collection and use of personal information for AI model development and training may be withdrawn through settings or consent management functionality provided by the Company or through customer support channels.
The Company may verify whether the requesting party is the data subject or a duly authorized representative where necessary to process a request relating to personal information.
Deletion or suspension of processing may be restricted with respect to personal information that must be retained under applicable laws and regulations.
A data subject may exercise rights relating to personal information through a duly authorized representative.
The Company may request documentation necessary to verify the representative’s authority.
Patty Code is not generally intended for use by children under the age of 14.
If the Company provides the Service to children under the age of 14 in the future, it will implement required protective procedures under applicable laws and regulations, including verification of consent from a legal representative.
Taking into account the nature and scope of the personal information processed, the processing environment, and the risks of personal information infringement, the Company implements administrative, technical, and physical safeguards necessary to ensure the security of personal information to the extent required by applicable laws and regulations.
The Company implements technical safeguards including:
The Company may create and manage audit records and security detection records for secure management of personal information and the Service, access control, prevention of fraudulent use, detection and response to security incidents, and auditability.
Audit records may include records relating to material activities by Administrators and Users, including access, permission changes, approvals, and execution involving the Service and personal information processing systems.
Security detection records may include identification information, access information, and detection results necessary to identify abnormal access, attempts to interfere with the Service, fraudulent use, or violations of security policies.
Audit records and security detection records are retained until membership withdrawal or termination of the service agreement. However, where retention is required under applicable laws and regulations or is necessary to investigate or respond to a security incident, fraudulent use, dispute, or legal claim, the records may be separately retained for the period necessary for such purpose.
The Company does not use such records for purposes other than those for which they were created and destroys them without undue delay when the applicable retention period expires or the reason for separate retention ceases to exist.
Where the Company directly stores personal information at a physical location or on physical equipment, it applies physical access controls and other protective measures required under applicable laws and regulations.
The Company has designated the following Personal Information Protection Officer to oversee personal information processing and to handle inquiries, complaints, and requests for remedies relating to personal information:
Data subjects may contact the Personal Information Protection Officer regarding privacy-related inquiries, complaints, remedies, and exercise of rights arising during use of the Service.
The Company accepts inquiries and complaints relating to personal information through its official customer support channels or the email address of the Personal Information Protection Officer.
Data subjects who require consultation or remedies in connection with an infringement of personal information rights may contact the following organizations:
The Company may amend this Privacy Policy to reflect changes in applicable laws and regulations, the Service, or methods of processing personal information.
Where this Privacy Policy is amended, the Company publishes the amended provisions and effective date through the Service or the Company’s website.
The Company provides advance notice of amendments and their effective date in accordance with applicable laws and regulations.
Where separate consent from a data subject is required under applicable laws and regulations, the Company does not rely solely on an amendment to this Privacy Policy and obtains the required consent.
In particular, where a new consent is required under applicable laws and regulations because the scope of personal information used for AI model development and training or the processing purposes are expanded in a manner adverse to Users, the Company obtains the required separate consent.
Previous versions of this Privacy Policy are retained and made available so that Users can review them.
This Privacy Policy shall take effect on September 1, 2026.
